Executive brief
Pedroetb TTS-API is a Node.js text-to-speech service that processes audio requests. An OS command injection vulnerability in the onSpeechDone function of app.js allows unauthenticated attackers on the network to execute arbitrary system commands by crafting malicious input, potentially compromising the server and any systems it can access.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the onSpeechDone function of app.js. The root cause is the use of child_process.exec() with unsanitized user input, which passes data through a shell interpreter and allows injection of arbitrary shell commands. The vulnerability is exploitable by any network attacker without authentication or user interaction required. An attacker can execute arbitrary OS commands with the privileges of the Node.js process, potentially achieving full system compromise. The patch (commit 29d9c25) addresses this by replacing child_process.exec() with child_process.spawn(), which does not invoke a shell and prevents command injection. Versions 2.2.0 and later include the fix.
Affected products
- Pedroetb TTS-API up to 2.1.4
Timeline
- 2019-07-14: other: Fix applied in commit 29d9c25
- 2023-12-19: disclosed